{
  "synthetic": true,
  "execution": "Teaching record only; no live integration tested",
  "slug": "password-recovery-token-handover",
  "group": "portal",
  "title": [
    "A password reset needs a one-use recovery contract",
    "重置密码，需要一次性恢复合同"
  ],
  "intro": [
    "A customer portal can have an attractive reset screen while leaving old recovery links usable. Before approving the recovery feature, agree what creates a token, what invalidates it and what evidence confirms a completed reset. This is separate from making the login form easy to use.",
    "资料门户的重置页面可能很好看，但旧恢复链接仍可继续使用。批准功能前，应约定令牌何时产生、何时失效，以及什么证据代表重置完成；这与登录表单是否易用不同。"
  ],
  "facts": [
    [
      "OWASP advises cryptographically secure, user-linked, expiring single-use recovery tokens, consistent account-existence responses and no account change before a valid token.",
      "OWASP建议采用安全随机、绑定用户、会过期且单次使用的恢复令牌，避免响应暴露账户是否存在，并在有效令牌前不改账户。",
      "https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html"
    ]
  ],
  "columns": [
    [
      "Synthetic request",
      "Declared test policy",
      "Expected result"
    ],
    [
      "合成请求",
      "本例声明的策略",
      "预期结果"
    ]
  ],
  "example": [
    [
      [
        "TokenT1 for userU1; issued 10:00",
        "Example expiry 10:15; now 10:10",
        "Valid forU1 once"
      ],
      [
        "T1绑定U1，10:00签发",
        "例子截止10:15；现在10:10",
        "只能供U1有效使用一次"
      ]
    ],
    [
      [
        "T1 after completed reset",
        "Used flag recorded",
        "Reject replay"
      ],
      [
        "T1完成重置后再次提交",
        "已记录使用状态",
        "拒绝重放"
      ]
    ],
    [
      [
        "T2 at 10:15",
        "Expiry reached",
        "Reject; offer new request flow"
      ],
      [
        "T2于10:15提交",
        "已到截止",
        "拒绝并提供重新申请路径"
      ]
    ],
    [
      [
        "T3 forU1 submitted forU2",
        "Account binding mismatch",
        "Reject without revealing account details"
      ],
      [
        "U1的T3用于U2",
        "账户绑定不符",
        "拒绝，不暴露账户资料"
      ]
    ]
  ],
  "steps": [
    [
      "Have the security owner choose the lifetime, abuse controls, delivery channel and session handling. Fifteen minutes here is an example policy, not an OWASP mandated duration.",
      "由安全负责人确定有效期、滥用防护、送达渠道及会话处理；本例十五分钟不是OWASP规定时限。"
    ],
    [
      "Use dummy accounts and synthetic token references in acceptance records. Test expiry boundaries, cross-account use, replay and unknown-email responses without logging usable tokens.",
      "验收记录仅用测试账户及合成令牌代号，测试截止、跨账户、重放和未知邮箱响应，不记录可用令牌。"
    ],
    [
      "Verify the password change and token consumption as one safe transaction. Confirm notification and existing-session treatment against the agreed policy, separately from email delivery.",
      "核对改密码与消耗令牌能安全完成，另按策略核对通知及旧会话处理，不与邮件送达混为一谈。"
    ]
  ],
  "result": [
    "T1 is valid once, not until somebody manually deletes a row. The acceptance evidence is the state transition and the denied second attempt; merely reaching a “reset complete” page proves less. A failed email does not justify relaxing identity checks or sending a usable link through public support.",
    "T1只能成功一次，不能等员工删记录才失效。验收依据是状态变化及第二次请求被拒绝，打开“重置完成”页证明得更少。邮件失败不能成为放宽身份核对或公开转发有效链接的理由。"
  ],
  "accept": [
    "Approve only after authorised tests show token binding, atomic consumption, expiry and a documented post-reset session policy. Retain redacted results, never token secrets.",
    "获准测试须证明绑定、原子消耗、过期及重置后会话策略；只保留脱敏结果，不能保留令牌秘密。"
  ],
  "limit": [
    "No reset, message, credential collection or real account action occurred. This is a supplier brief, not a complete authentication implementation or security certification.",
    "没有重置、发信、收集密码或操作真实账户；本文是供应商任务书，不是完整身份系统或安全认证。"
  ]
}